NEAS[.]3000e13dc9a031686057711a9a301e50[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3000e13dc9a031686057711a9a301e50.exe
Size

119KB
MD5

3000e13dc9a031686057711a9a301e50
SHA1

46f257c8b0266dbab245ade0688290904a6f1d7a
SHA256

b0498ed188fded2c3cedcd75a292020af9d2bc7c10f090b002e93959c0e2ca29
SHA512

dd0d3119c123af584d27837954f24a671f1995b8700485814d61fce457304780595844faccafcaf03c547b27ef8173eaba4efe34a6e5999259da29a64b4430a2
SSDEEP

1536:4IWwNqXBDSp/KLI6cqtv3Ic81Ma7ea+JkIKHOh2SY7yuW0JDPn9TstpLXlnRai0y:4XrXlAiLIPqnNOvmhS7S0pnKLXqi0jQ7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3000e13dc9a031686057711a9a301e50.exe

Files

NEAS.3000e13dc9a031686057711a9a301e50.exe
.exe windows:4 windows x86

2d44cca0b1d34bc9a060b46eb979aeab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThreadpoolWork
LZOpenFileA
SetLocalPrimaryComputerNameW
CreateWaitableTimerExW
IsBadHugeReadPtr
Wow64SetThreadContext
AcquireSRWLockShared
GlobalUnlock
BaseFlushAppcompatCache
OpenJobObjectW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE